Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
A KQL job should promote 90 days of filtered sign-in data from the data lake into a new table in the analytics tier of the SOC workspace. You hold Security Operator in Microsoft Entra ID. The job fails when it tries to create the table. What fixes it?
AWrite the results to a federated table instead
BAssign Log Analytics Contributor on the workspace to the data lake managed identity
CAdd the _CL suffix to the table name yourself
DSchedule the job to start at least 30 minutes after creation so the table exists first
Show the answer and why
AWrite the results to a federated table instead
Incorrect
Jobs can't write to federated tables.
BAssign Log Analytics Contributor on the workspace to the data lake managed identity
Correct
Creating new custom tables in the analytics tier needs this role for the msg-resources managed identity.
CAdd the _CL suffix to the table name yourself
Incorrect
The service adds _KQL_CL to tables the job creates.
DSchedule the job to start at least 30 minutes after creation so the table exists first
Incorrect
The start-time rule applies to scheduled jobs, not to table creation.
KQL jobs can promote lake data to the analytics tier. To create new custom tables there, assign the Log Analytics Contributor role on the workspace to the data lake's managed identity (msg-resources-<guid>). Tables created by a job get the _KQL_CL suffix, and jobs can't write to federated tables.
A Sentinel workspace that isn't onboarded to the data lake stores firewall flow logs in an Auxiliary table. Analysts need per-source-IP counts refreshed every 30 minutes in an analytics table for detections. Which feature fits?
AA KQL job scheduled every 30 minutes
BA search job each half hour
CAn NRT analytics rule on the Auxiliary table
DA summary rule that writes to a custom analytics table
Show the answer and why
AA KQL job scheduled every 30 minutes
Incorrect
KQL jobs need the data lake onboarding that this workspace lacks.
BA search job each half hour
Incorrect
Search jobs are one-time, long-running searches of a single table.
CAn NRT analytics rule on the Auxiliary table
Incorrect
Real-time rules don't run on low-cost tiers.
DA summary rule that writes to a custom analytics table
Correct
Summary rules aggregate Auxiliary or Basic data on a 20-minute to 24-hour schedule.
Summary rules run frequent aggregations in the background and store results in analytics-tier custom tables. They're the choice when data is in a workspace that isn't onboarded to the data lake, for example in Auxiliary or Basic tiers, and when you need frequent summaries.
Your workspace was onboarded to the Sentinel data lake in June. An investigation needs SecurityEvent records from long-term retention covering March, which predates onboarding. Which tool do you use to pull them into a table for analysis?
AA KQL job over the lake for March
BRestore on the data lake tier
CA search job on the SecurityEvent table
DA summary rule with a 90-day lookback
Show the answer and why
AA KQL job over the lake for March
Incorrect
KQL jobs serve data from the onboarding date onward.
BRestore on the data lake tier
Incorrect
Restore isn't available for data lake tier data.
CA search job on the SecurityEvent table
Correct
Search jobs reach archived data older than the onboarding date.
DA summary rule with a 90-day lookback
Incorrect
Summary rules look back at most one day.
If you're onboarded to the Microsoft Sentinel data lake, use search jobs to access archived data older than your onboarding date, and KQL jobs for data from the onboarding date onward. A search job scans a single table and writes results to a new analytics table.
After onboarding to the Defender portal, a hunter runs a query in advanced hunting and wants to bookmark three suspicious rows with notes and entity mappings, as they did in Sentinel. The option isn't there. Where do they create the bookmarks?
AMicrosoft Sentinel > Threat management > Hunting
BAdvanced hunting, after enabling guided mode
CThe Action center, from the query results
DA custom detection that saves the rows
Show the answer and why
AMicrosoft Sentinel > Threat management > Hunting
Correct
Bookmarks are still available in the Sentinel-specific hunting experience.
BAdvanced hunting, after enabling guided mode
Incorrect
Bookmarks aren't available in advanced hunting in either mode.
CThe Action center, from the query results
Incorrect
The Action center tracks remediation actions.
DA custom detection that saves the rows
Incorrect
Detections create alerts, not bookmarks with notes.
Bookmarks aren't available in advanced hunting, the unified query experience across Defender and Sentinel data. They remain in Microsoft Sentinel > Threat management > Hunting, where results can be bookmarked with notes, entity and MITRE ATT&CK mappings and escalated to incidents.
A hunter adds the Sentinel MCP data exploration collection to Visual Studio Code. The tenant is onboarded to the Sentinel data lake, but the hunter can't list any of the collection's tools, including the table search and query tools that don't use Security Copilot. What's the hunter most likely missing?
AA Security Copilot SCU allocation
BThe Security reader role
CA self-hosted MCP server in Azure
DMicrosoft Sentinel Playbook Operator
Show the answer and why
AA Security Copilot SCU allocation
Incorrect
SCUs are consumed only by specific tools, such as the entity analyzer; they don't gate listing the collection's tools.
BThe Security reader role
Correct
Listing and invoking Sentinel's MCP tools needs Security reader.
CA self-hosted MCP server in Azure
Incorrect
The server is fully hosted; nothing is deployed.
DMicrosoft Sentinel Playbook Operator
Incorrect
Playbook roles don't grant MCP tool access.
Microsoft Sentinel's MCP server is hosted and uses Microsoft Entra for identity. Most tools require data lake onboarding, some also need Sentinel in the Defender portal, Defender XDR or Security Copilot, and users need the Security reader role to list and invoke the tools.
A hunter builds a PySpark notebook in the Microsoft Sentinel extension for Visual Studio Code that scores risky sign-ins from lake data. The scores must land in a custom lake table every night without anyone running the notebook. Which two pieces do this? (Choose TWO.)
ARun the notebook from the classic Sentinel notebooks blade instead
BRun the notebook from advanced hunting
CPaste the Python cells into a KQL job
DWrite the results with MicrosoftSentinelProvider.save_as_table()
ESchedule the notebook as a notebook job
Show the answer and why
ARun the notebook from the classic Sentinel notebooks blade instead
Incorrect
That's a different experience from data lake notebooks, without these jobs.
BRun the notebook from advanced hunting
Incorrect
Advanced hunting runs KQL queries, not notebooks.
CPaste the Python cells into a KQL job
Incorrect
KQL jobs run KQL queries only.
DWrite the results with MicrosoftSentinelProvider.save_as_table()
Correct
The provider class writes the results to custom tables.
ESchedule the notebook as a notebook job
Correct
Notebook jobs run notebooks on a schedule and write results to tables.
Data lake notebooks come from the Microsoft Sentinel extension for Visual Studio Code and run PySpark on Spark compute. The MicrosoftSentinelProvider class's save_as_table() function writes or appends results to custom tables, and notebook jobs run the notebook on a schedule.
On the Microsoft Sentinel Hunting page, you sort queries by Results delta to spot spikes. What does Results delta compare?
AYour results with other Sentinel customers' results
BResults this week with last week
CResults in the last 24 hours with the previous 24 to 48 hours
DQuery results with analytics rule alerts
Show the answer and why
AYour results with other Sentinel customers' results
Incorrect
Results come only from your workspace.
BResults this week with last week
Incorrect
The comparison windows are 24 hours long.
CResults in the last 24 hours with the previous 24 to 48 hours
Correct
Results delta compares the last 24 hours against the previous 24-48 hours.
DQuery results with analytics rule alerts
Incorrect
It compares a query's own results over time.
Results delta and Results delta percentage compare a hunting query's results in the last 24 hours with the previous 24-48 hours, highlighting large differences in volume.
A hunter used Microsoft Sentinel livestream sessions to watch for an attacker's tools during an active incident. That option is gone. What does Microsoft suggest instead to keep running the query and notify the team?
AKeep the hunting query as a favorite so it reruns every minute
BKQL jobs, analytics rules or playbooks
CBookmarks on each result
DA workbook with auto refresh
Show the answer and why
AKeep the hunting query as a favorite so it reruns every minute
Incorrect
Favorites run when the Hunting page opens, not on a schedule.
BKQL jobs, analytics rules or playbooks
Correct
They're the stated alternatives, with persistent results and notifications.
CBookmarks on each result
Incorrect
Bookmarks preserve rows; they don't run queries.
DA workbook with auto refresh
Incorrect
Workbooks visualize data; they don't notify anyone.
Microsoft Sentinel livestreams are no longer available. To automate queries and notifications, use KQL jobs, analytics rules or playbooks, which offer persistent query results and support messaging platforms.
On the Microsoft Sentinel Hunting page, the Queries tab lists the hunting queries installed from Content hub solutions. How are they grouped?
ABy MITRE ATT&CK tactic
BBy data connector
CBy the analyst who created them
DBy incident severity
Show the answer and why
ABy MITRE ATT&CK tactic
Correct
All hunting queries on the Queries tab are grouped by MITRE ATT&CK tactics.
BBy data connector
Incorrect
You can filter by data source, but grouping is by tactic.
CBy the analyst who created them
Incorrect
Authorship isn't the grouping.
DBy incident severity
Incorrect
Hunting queries aren't tied to incident severity.
The Queries tab lists the hunting queries installed with Content hub solutions and any you created. Queries are grouped by their MITRE ATT&CK tactics, and you can sort and filter by data source, tactic, technique, results and results delta.
You want an AI agent to prioritize open incidents and run hunts over your organization's data through the Sentinel MCP server. Which tool collection do you connect?
AData exploration
BSecurity Copilot agent creation
CGraph builder
DTriage
Show the answer and why
AData exploration
Incorrect
It's for exploring tables and lake data.
BSecurity Copilot agent creation
Incorrect
It builds Security Copilot agents.
CGraph builder
Incorrect
There's no MCP collection by that name.
DTriage
Correct
The triage collection is for triaging incidents and hunting.
Sentinel's MCP server offers the Data exploration, Security Copilot agent creation and Triage collections. Triage integrates AI models with APIs that support incident triage and hunting.